View Full Version : ntuser.dat & ntuser.dat log
Prushka
January 20th, 2005, 04:49 AM
Is internet content added to the ntuser.dat file while browsing the internet, on closing IE, on shut down, or not at all.
I was viewing the ntuser.dat file in wordpad (with word wrap)
Talk about eye strain.
I noticed some 200 fractual programs (listed by name), which I did some 2 years ago, including the program used to create them and graphic programs used alter them, and program viewers like Irfan view,etc.
I don't think it is possible for a program like MRU blaster to deal with this issue, although I was able to restore the ntuser.dat & ntuser.dat log to default.
Details available on request
banks
January 27th, 2005, 11:22 PM
how did you do this
AJohn
January 30th, 2005, 05:54 AM
I know www.jetico.com has a program that deals with this. It even has the ability to encrypt it.
Analyst502
April 18th, 2005, 03:04 PM
Any luck on this? I'm trying to clean my NTUSER.DAT file and keep running into dead-ends. Any help is appreciated
jrebeiro
May 8th, 2005, 08:17 PM
Why are you loading the file in notepad... you risk possible corruption. Load the hive using regedit or regedt32.
ZBob
July 25th, 2005, 06:48 PM
Can somone please tell me what the ntuser.dat is because i think somone was messing with mine. I wanted to know what they could do with it.
Peter2150
August 3rd, 2005, 07:52 AM
-{ Quote: "Can somone please tell me what the ntuser.dat is because i think somone was messing with mine. I wanted to know what they could do with it." }-
Hi Zbob
Unless I am mistaken this file is your registry. I would heed the caution above about opening with anything but regedit or some appropriate other registry editor. Be careful.
Pete
Cheeky
November 3rd, 2005, 10:56 AM
yeh ive been lookin in mine too and i have the signature Dirty is this right cus every time i hav a problem with spyware or somethin similar this name seems to crop up !! Seems they are accessin my administrator windows settings files!
Nihil
November 6th, 2005, 08:43 AM
ntuser.dat is a registry hive file that loads as HKEY_CURRENT_USER when a user logs on. The HKEY_CURRENT_USER (ntuser.dat) contains the user profile for the user who is currently logged on to the computer. The user profile includes environment variables, personal program groups, desktop settings, network connections, printers, and application preferences.
You can edit HKEY_CURRENT_USER of other users by loading this hive under HKEY_USERS (you must log on as administrator to edit this hive).
Roozter
November 29th, 2005, 11:14 AM
What if I deleted these two files and I am on a Novell LAN?
Roozter
November 29th, 2005, 11:27 AM
What if I deleted these two files and I am on a Novell LAN?
kmot
December 6th, 2005, 10:56 PM
what is ntuser.dat & utnser.dat log?
What does they do?
Brinn
December 11th, 2005, 10:13 PM
-{ Quote: "what is ntuser.dat & utnser.dat log?
What does they do?" }-
Did you read the thread?
Call me Rob
December 13th, 2005, 09:40 AM
ntuserdat is the registry protion HKEY_Current_User that when logging off is
transformed into NTUserdat. and updated into your profile. Nd ofcourse is loaded into the registry while logging on :-)
to clean it .. Use regedit and 'clean' YOUR Hkey_Current_user hive :-)
simple ..(ahum :-s)
Togg
December 16th, 2005, 02:15 PM
You may be seeing something called User Assist files which, apparently, store lots of useless looking information in the Registry.
Have a look at this article; http://www.utdallas.edu/~jeremy.bryan.smith/ You can d/l the authors' User Assist Spy program from the link further down the page if you're interested.
MRU Blaster and CCleaner appear to delete/clean these files, and I'm sure that there are lots of other programs that will deal with them.
If you're really adventurous you could try the script in the article, but I wouldn't!
Germancho
December 18th, 2005, 04:57 AM
Well, I untimely turned my computer off, and now it cannot load my profile, I checked the systemlog and apparently something happened that corrupted ntuser.dat (it's there, but it can't find it) and it opens a temporary profile each time I log in as an admin. Is there a way to repair it or to copy it from somewhere else? How do I use regedit to repair it?
tjeM
December 20th, 2005, 05:23 AM
Is the login password also stored in ntuser.dat ?
Or is that stored somewhere else just for knowing...
vBulletin® Copyright ©2000-2012, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2012, Wilders Security Forums